JWT No Validation (ARCH4126)

Key java.security.jwt-no-validation · Severity error · Category security · CWE CWE-347

Decoding a JWT body without verifying its signature (e.g. just parsing the payload) lets attackers forge tokens and bypass authentication. Always validate the token with signature and claim checks.

Incorrect

String[] parts = token.split("\\.");
String payload = new String(Base64.getUrlDecoder().decode(parts[1]));
Claims claims = mapper.readValue(payload, Claims.class); // signature not verified

Correct

Claims claims = Jwts.parserBuilder()
    .setSigningKey(publicKey)
    .build()
    .parseClaimsJws(token) // verifies signature and expiry
    .getBody();

Fix

Use a parser that verifies the JWT against the signing key; never decode the payload without validation.